CCNA Network Services and Security Practice Question
Exhibit
access-list 101 deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 23 access-list 101 permit ip any any ! interface g0/1 ip access-group 101 out
A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?
⚠ Common exam trap
Cisco often tests the concept that an ACL's effectiveness depends on its placement and direction, not just its content, and the trap here is that candidates focus on the wildcard mask or ACL type while overlooking the fundamental requirement of correct application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ACL is applied in the wrong place or direction
The most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255
Why it's wrong here
Cisco wildcard masks use 0 bits to mean 'must match' and 1 bits to mean 'ignore,' which is the exact inverse of a subnet mask. For a /24 network, the correct wildcard mask is 0.0.0.255 because it matches the first three octets exactly and ignores only the host bits. A wildcard mask of 255.255.255.0 would ignore almost everything, effectively matching any address, so it would not restrict Telnet traffic as intended.
When this WOULD be correct
In a different scenario where the question specifies that the ACL is incorrectly configured to allow traffic from a broader range, such as 192.168.0.0/16, the option could be correct if it required a wildcard mask of 255.255.255.0 to block a specific subnet.
- ✓
The ACL is applied in the wrong place or direction
Why this is correct
This is an attachment problem, not a syntax problem: the ACL itself may be perfectly valid, but it is not doing its job because it is bound to the wrong interface or direction. To filter Telnet into the router, the ACL must be applied to the VTY lines with the access-class command; to filter transit traffic, it must be applied to the correct interface with the proper inbound or outbound keyword. A misapplied ACL is effectively invisible to traffic, which is why the filter appears to have no effect.
- ✗
Standard ACLs should always be used for Telnet filtering
Why it's wrong here
Standard ACLs only evaluate the source IP address, so they cannot specifically match Telnet's TCP port 23 or destination host. Extended ACLs are the appropriate choice here because they allow you to match the protocol (TCP) and destination port (23), making it possible to restrict Telnet access precisely by source address. Saying that standard ACLs 'should always' be used for Telnet filtering is incorrect because they lack the granularity that Telnet filtering requires.
When this WOULD be correct
In a scenario where the question specifies that only standard ACLs are allowed for filtering traffic, and the configuration is incorrectly using an extended ACL to block Telnet, this option would be correct. For example, if the question states that only standard ACLs can be used to filter access to a specific service, then this option would apply.
- ✗
The router must run PAT before ACLs can filter Telnet
Why it's wrong here
PAT (Port Address Translation) changes the source IP address and port of outbound packets, but it has no relationship to how ACLs evaluate or filter traffic. An ACL inspects packet headers independently and can match on protocol, source/destination IP, and source/destination port without any NAT/PAT being configured. Therefore, running PAT is neither a prerequisite nor a factor in whether an ACL can filter Telnet; the two functions are completely separate.
When this WOULD be correct
In a different scenario where a question states that a router is configured with NAT and ACLs, and the ACL is not filtering Telnet traffic as expected, the correct answer could be that PAT must be configured correctly for ACLs to function as intended. This would imply that NAT is interfering with the ACL's ability to filter traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The ACL is applied in the wrong place or directionCorrect answer▾
Why this is correct
This is an attachment problem, not a syntax problem: the ACL itself may be perfectly valid, but it is not doing its job because it is bound to the wrong interface or direction. To filter Telnet into the router, the ACL must be applied to the VTY lines with the access-class command; to filter transit traffic, it must be applied to the correct interface with the proper inbound or outbound keyword. A misapplied ACL is effectively invisible to traffic, which is why the filter appears to have no effect.
✗The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255Wrong answer — click to see why▾
Why this is wrong here
The wildcard mask 255.255.255.0 would match only the exact host 192.168.10.0, not the entire /24 subnet. Cisco ACLs use wildcard masks where 0 means match and 1 means ignore; for a /24, the correct mask is 0.0.0.255.
★ When this WOULD be the correct answer
In a different scenario where the question specifies that the ACL is incorrectly configured to allow traffic from a broader range, such as 192.168.0.0/16, the option could be correct if it required a wildcard mask of 255.255.255.0 to block a specific subnet.
Why candidates choose this
Students often confuse wildcard masks with subnet masks, thinking that 255.255.255.0 is the correct way to specify a /24 network, but in ACLs the logic is inverted.
✗Standard ACLs should always be used for Telnet filteringWrong answer — click to see why▾
Why this is wrong here
Standard ACLs can only filter based on source IP address and cannot match specific protocols like Telnet (TCP port 23) or destination addresses. Extended ACLs are required to filter Telnet traffic from a specific source to a specific destination.
★ When this WOULD be the correct answer
In a scenario where the question specifies that only standard ACLs are allowed for filtering traffic, and the configuration is incorrectly using an extended ACL to block Telnet, this option would be correct. For example, if the question states that only standard ACLs can be used to filter access to a specific service, then this option would apply.
Why candidates choose this
Some students think standard ACLs are simpler and sufficient for all filtering, but they lack the granularity needed for protocol-specific or destination-specific rules.
✗The router must run PAT before ACLs can filter TelnetWrong answer — click to see why▾
Why this is wrong here
PAT (Port Address Translation) is unrelated to ACL filtering. ACLs operate independently of NAT/PAT; they filter traffic based on Layer 3 and Layer 4 information regardless of whether translation is configured.
★ When this WOULD be the correct answer
In a different scenario where a question states that a router is configured with NAT and ACLs, and the ACL is not filtering Telnet traffic as expected, the correct answer could be that PAT must be configured correctly for ACLs to function as intended. This would imply that NAT is interfering with the ACL's ability to filter traffic.
Why candidates choose this
Students may confuse the order of operations or think that NAT must be applied before ACLs can work, but ACLs are processed before or after NAT depending on direction, and PAT is not a prerequisite for ACL functionality.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Wildcard mask
A wildcard mask is a sequence of 32 bits used alongside an IP address to define which bits must match and which are ignored for routing, access control, or network matching purposes.
Key term
PAT
PAT (Port Address Translation) is a method of network address translation that maps multiple private IP addresses to a single public IP address by using different port numbers for each connection.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.